CVE-2026-111854

Executive Summary

CVE-2026-111854 is a path traversal vulnerability (CWE-22) in the SCPI FILESystem command interface of Tektronix 3 Series MDO mixed-domain oscilloscopes running firmware before 1.21.1. An authenticated, network-adjacent or network-reachable attacker with SCPI access can supply insufficiently validated file paths to filesystem access commands to read or modify arbitrary files on the device. With a CVSS base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the flaw primarily threatens the integrity and confidentiality of the instrument's operating system, configurations, and stored acquisition data rather than directly offering code execution as described.

Technical Analysis

The vulnerability resides in the SCPI (Standard Commands for Programmable Instruments) FILESystem command interface — the subsystem that exposes file operations (such as reading, writing, or enumerating files) to remote control clients over SCPI transport. The NVD description states the root cause is "insufficient validation of file paths supplied to filesystem access commands," resulting in a path traversal condition.

Path traversal (CWE-22) arises when user-supplied path strings are passed to file operations without adequately canonicalizing and constraining them to an intended directory. By embedding relative path sequences (the classic ../ traversal idiom) or otherwise escaping the intended base directory, an attacker redirects a file read or write primitive to an arbitrary location on the device filesystem.

Attack surface characteristics:

• Transport: SCPI is reachable over network transports commonly used by instrumentation (e.g., a raw TCP SCPI socket on the traditional instrumentation port, or VXI-11/USBTMC-style channels). The CVSS AV:N metric confirms network reachability.
• Privilege requirement (PR:L): The attacker must possess the privilege to issue filesystem SCPI commands — in practice some level of session access or authentication to the SCPI interface. This is reflected in the PR:L rating.
• Impact mechanism: The two primitives enabled are file read (confidentiality, C:H) and file write/modify (integrity, I:H). There is no availability impact (A:N) described, indicating the flaw does not inherently cause denial of service.

The exact SCPI command mnemonics, parameter names, and the vulnerable code path are not disclosed in the available NVD description or CNA title. No public proof-of-concept, exploit code, or Nuclei template has been identified. Accordingly, the description of the flaw should be understood at the vulnerability-class level: insufficient path validation on filesystem SCPI commands permits traversal outside the intended directory. Specific implementation details (function names, exact endpoints, parameter syntax) are not available and are not asserted here.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-22) and the CVSS vector, not from disclosed implementation details.

1. Reconnaissance / target identification. An attacker identifies a reachable Tektronix 3 Series MDO instrument, for example via network scanning for SCPI-bearing services or via Shodan-style reconnaissance of internet-exposed instrumentation. The attacker confirms the model and, where possible, firmware version to determine whether the device is below 1.21.1.

2. Establishing SCPI access. Because the vector requires PR:L, the attacker first obtains the privilege needed to send SCPI FILESystem commands (e.g., an existing session, default/weak credentials, or an already-authorized control channel). This may be achieved through prior access or credential reuse rather than through this CVE itself.

3. Triggering the traversal. The attacker issues filesystem access commands through the SCPI interface while supplying a crafted path containing traversal sequences, so that the path resolves outside the intended base directory. This constitutes the core exploit step: the insufficient validation fails to constrain the path, and the file operation acts on an attacker-chosen location.

4. Payload / execution method. Using the file read primitive, the attacker can retrieve arbitrary files whose contents may disclose configuration, credentials, logs, or stored acquisition data. Using the file write/modify primitive, the attacker can overwrite or plant files, corrupting instrument state or persisting tampered content. There is no code-execution primitive described by this CVE; impact is limited to read/modify of files, consistent with the A:N (no availability) rating.

5. Post-exploitation impact. Consequences include disclosure of sensitive device data, integrity compromise of configuration or measurement files, and potential persistence through modified on-device files. Because these instruments frequently integrate with lab networks and test pipelines, a compromised device can become a pivot or a source of corrupted, untrustworthy measurement data feeding upstream systems.

Impact Assessment

• Confidentiality (C:H): Arbitrary file read can expose device configuration, stored data, and potentially credentials or operational details present in files on the instrument.
• Integrity (I:H): Arbitrary file modification allows tampering with configurations and data, undermining the trustworthiness of measurements and instrument state.
• Availability (A:N): No availability impact is described.
• Access vector / complexity: AV:N with AC:L indicates the flaw is exploitable remotely with low complexity once access is obtained; PR:L and UI:N indicate a low-privileged attacker needing no user interaction.

Blast radius: Each 3 Series MDO device running pre-1.21.1 firmware is individually affected. The primary business risk is not mass exploitation reaching code execution, but the corruption or exfiltration of sensitive laboratory/engineering data and the subversion of instrument integrity — particularly where these oscilloscopes operate in shared lab networks, manufacturing/test benches, or environments with connectivity to broader enterprise infrastructure. Because the CVSS vector requires low-level privilege, the practical external risk depends on how exposed and how weakly protected the SCPI interface is.

CISA KEV status: NO. EPSS: not yet scored (no value fabricated). No known in-the-wild exploitation reported in the available data.

Detection Guidance

Sigma Rule

Detects reconnaissance or use of filesystem-oriented SCPI commands and traversal sequences in process or network control logs where instrumentation control software is monitored.

title: Potential Path Traversal via SCPI FILESystem Command Interface
id: 5b1f3c2a-8d4e-4a7b-9c6f-1e2d3a4b5c6d
status: experimental
description: Detects file paths containing path traversal sequences sent to or processed by SCPI filesystem command interfaces on Tektronix 3 Series MDO instruments or controlling hosts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-111854
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_scpi:
    CommandLine|contains:
      - 'FILESystem'
      - 'MMEM'
      - 'SCPI'
  selection_traversal:
    CommandLine|contains:
      - '../'
      - '..\\'
      - '%2e%2e'
      - '..%2f'
  condition: selection_scpi and selection_traversal
fields:
  - CommandLine
  - Image
  - ParentImage
falsepositives:
  - Legitimate engineering scripts referencing relative paths with SCPI tools
level: high

Note: Because exact SCPI mnemonics are not disclosed, the rule keys on the generic filesystem/SCPI tokens and traversal markers; tune to your environment and instrumentation tooling.

YARA Rule

Scans captured network payloads or logs for SCPI filesystem command usage combined with traversal sequences.

rule CVE_2026_111854_SCPI_Path_Traversal
{
    meta:
        description = "Detects SCPI filesystem commands with path traversal sequences targeting Tektronix 3 Series MDO (CVE-2026-111854)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-111854"
        cve = "CVE-2026-111854"
        author = "Threat Intelligence"
        date = "2026-01-01"

    strings:
        $scpi_fs1 = "FILESystem" ascii nocase
        $scpi_fs2 = "MMEM" ascii nocase
        $trav1 = "../" ascii
        $trav2 = "..\\" ascii
        $trav3 = "..%2f" ascii nocase
        $trav4 = "%2e%2e" ascii nocase

    condition:
        ($scpi_fs1 or $scpi_fs2) and any of ($trav*)
}

Suricata IDS Rule

Detects traversal sequences within SCPI-oriented traffic.

alert tcp any any -> any 5025 (msg:"CVE-2026-111854 SCPI FILESystem Path Traversal Attempt"; flow:to_server,established; content:"FILESystem"; nocase; content:"../"; nocase; distance:0; within:256; sid:2026111854; rev:1; reference:cve,2026-111854; classtype:attempted-recon; metadata:affected_product Tektronix_3_Series_MDO, attack_target Embedded_Device, created_at 2026_01_01;)

alert tcp any any -> any 5025 (msg:"CVE-2026-111854 SCPI Path Traversal Sequence (encoded)"; flow:to_server,established; content:"MMEM"; nocase; pcre:"/(\.\.\/|\.\.\\|%2e%2e)/i"; sid:2026111855; rev:1; reference:cve,2026-111854; classtype:attempted-recon;)

Note: Port 5025 (the common raw SCPI socket) is used as a working assumption for network instrumentation; adjust the destination port for your environment's SCPI transport.

Elastic Detection

EQL rule correlating SCPI filesystem command tokens with traversal sequences in process or network command-line telemetry on instrument-controlling hosts.

process where
  process.command_line != null and
  (process.command_line : "*FILESystem*" or process.command_line : "*MMEM*") and
  (process.command_line : "*../*" or process.command_line : "*..\\*" or process.command_line : "*%2e%2e*")

Splunk SPL Query

Searches proxy, network, or endpoint logs for SCPI filesystem commands with traversal markers.

index=* (sourcetype=*proxy* OR sourcetype=*firewall* OR sourcetype=*network* OR sourcetype=*sysmon*)
| eval raw=coalesce(url, uri, http_uri, CommandLine, _raw)
| where (match(raw,"(?i)filesystem") OR match(raw,"(?i)mmem"))
    AND (match(raw,"(\.\./|\.\.\\|%2e%2e|\.\.%2f)"))
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as src_ips by dest, dest_port
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

Wazuh rule to alert on SCPI path traversal indicators in collected logs.

<group name="tektronix,scpi,cve-2026-111854,">
  <rule id="2026119" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">(?i)(filesystem|mmem).*(\.\.\/|\.\.\\|%2e%2e)</field>
    <description>CVE-2026-111854: Potential SCPI FILESystem path traversal attempt against Tektronix 3 Series MDO</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,cve_2026_111854,</group>
  </rule>
</group>

Tune the decoded format and field name to your log source; the rule keys on the SCPI filesystem tokens paired with traversal markers.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description references firmware "before 1.21.1" as affected, implying 1.21.1 as the fixed release, but no independently confirmed vendor advisory or patch artifact was available from tracked feeds.

1. Immediate mitigations

   • Network-segment or isolate Tektronix 3 Series MDO instruments; do not expose SCPI interfaces to untrusted or internet-facing networks.
   • Restrict access to SCPI-bearing ports to authorized control hosts via firewall ACLs and network segmentation.
   • Enforce strong authentication and least privilege on any existing SCPI/remote-control access to raise the effective barrier above PR:L.
   • Monitor for traversal patterns in instrumentation traffic (see detection rules).

2. Patch / upgrade steps

   • Verify current firmware version on each 3 Series MDO device.
   • Upgrade to firmware 1.21.1 or later following the vendor's documented upgrade procedure (per the NVD description). Coordinate with Tektronix support to confirm the release and integrity of the firmware image.
   • Re-validate configuration and stored data after upgrade for signs of prior tampering.

3. Long-term hardening

   • Maintain an inventory of network-reachable instrumentation and apply a firmware-update cadence.
   • Adopt default-deny network policy around lab/test equipment.
   • Log and alert on SCPI command usage and file-path arguments; retain telemetry for forensic review.
   • Track vendor advisories directly, since this CVE currently lacks confirmed patch evidence in public feeds.

References

• NVD — CVE-2026-111854: https://nvd.nist.gov/vuln/detail/CVE-2026-111854
• MITRE CWE-22 (Path Traversal): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• Tektronix product/support portal for 3 Series MDO firmware (consult the vendor directly for the 1.21.1 release and advisory): https://www.tek.com/
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-111854 not currently listed — verify status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / in-the-wild evidence: None identified in the available data. No public PoC, exploit code, or Nuclei template was found, and the CVE is not in CISA KEV.